Cybersecurity
Exaforce described data theft within minutes of access
In a sponsored report, Exaforce said it saw attackers pull data or enumerate systems within 15 minutes of access across token theft, AI-tool lures and help-desk vishing.
- Exaforce said its analysis covered three attack patterns in which attackers began enumerating or pulling data within 15 minutes of gaining access.
- In one case, a GitHub Desktop OAuth token sat in a Mac keychain for 95 days before it was used on 19 June, and Exaforce said it then pulled 76 repositories in about 15 seconds.
- Exaforce said its platform flagged that token use within five minutes, but by the time action was taken the attacker had taken data from 472 of 638 repositories.
- The article said a fake Claude Code installation command loaded a macOS stealer, and separate vishing cases saw bulk downloads start 2.5 to 7 minutes after MFA approval.
- Exaforce said one of the vishing cases involved 140,000 files and a ransom demand for the leaked data.
Exaforce said its report found that attackers were often able to start pulling data or mapping systems within 15 minutes of initial access. It grouped the incidents into stolen developer tokens, fake AI-tool installation prompts and help-desk vishing.
In the token case, a developer had installed GitHub Desktop in March, signed in and stopped using it the same day. Exaforce said the resulting OAuth token remained in the Mac keychain for 95 days before someone else used it on 19 June to pull 76 repositories.
The company said the activity came from residential proxies in more than two dozen European cities and that GitHub did not alert because it did not watch token usage. Exaforce said its platform detected the activity within five minutes and that its analysts confirmed the exfiltration soon afterwards, but the attacker had already taken data from 472 of 638 repositories.
For the AI-tool case, the article said an employee looking for Claude Code instructions found a shared Claude conversation with an install command that loaded a macOS stealer. In the vishing examples, Exaforce said attackers registered MFA devices and began bulk downloads within minutes after a push was approved, with one case involving 140,000 files and a ransom demand.
The article then argued for automated response actions such as revoking sessions, removing MFA methods and disabling keys before human approval slows containment. It listed GitHub, Okta, Microsoft Entra ID, Google Workspace, Snowflake, AWS and Anthropic among the systems for which it recommended prebuilt revocation actions.
Named in this story
Companies
- Exaforce
- said its platform detected and triaged the incidents it described
- GitHub
- was the service from which repositories were taken using stolen tokens
- Okta
- was one of the identity systems discussed for session revocation
- Microsoft
- was cited in a write-up and in later alert handling in the vishing examples
- Anthropic
- was listed among the AI services for which response actions were recommended
- Snowflake
- was listed among the data platforms for which response actions were recommended
- OpenAI
- was listed among the AI services for which response actions were recommended
- AWS
- was named as a cloud service whose sessions could keep running after SSO revocation
Organisations
- Scattered Spider
- was the group whose help-desk script the article said many calls followed
Products and systems
- GitHub Desktop
- created the OAuth token in the March case
- Claude
- hosted a shared conversation used to lure the victim
- Claude Code
- was the fake installation target in the ClickFix lure
- macOS
- was the operating system on which the stealer ran
- Microsoft Entra ID
- was one of the identity providers discussed for revoking tokens and methods
How the source tells it
The register was promotional and urgent, with the article pushing Exaforce’s detection and response products while stressing very short attack timelines.
- urgency repeated time-to-exfiltration claims and machine-speed framing
- vendor boosterism first-person product claims, feature counts, and a demo pitch